Volt TyphoonG1017 ↗
Has run system checks to determine if they were operating in a virtualized environment.1
tfMITRE ATT&CK sub-technique
System Checks T1497.001
sub-technique of T1497 Virtualization/Sandbox Evasion
- Platforms
- Linux, macOS, Windows
- Version
- 3.0
- Created
- 06 March 2020
- Last modified
- 12 May 2026
- Contributors
- Deloitte Threat Library Team; Kostya Vasilkov
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
7
Threat groupsTop 23%
Threat groups77th percentile · 77% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.61
Tools & malwareTop 6%
Tools & malware94th percentile · 94% of ATT&CK techniques have this many tools implementing them or fewer.3
Detection rules54th pct
Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.System Checks MITRE reference T1497.001
Top 23%of all ATT&CK techniques for number of groups
7 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
EvilnumG0120 ↗
Has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments. 1
KimsukyG0094 ↗
Has detected and killed virtual environments by using the PowerShell cmdlet Get-CimInstance that searches the classname of the computer system manufacturer through an if statement of if($computerSystem.Manufacturer -match "VMware" -or $computerSystem.Manufacturer -match "Microsoft" -or $computerSystem.Manufacturer -match "VirtualBox").1
WIRTEG0090 ↗
Has configured C2 servers to check location and user-agent strings for victim endpoints to prevent sending a payload to sandboxed environments.1
OilRigG0049 ↗
Has used macros to verify if a mouse is connected to a compromised machine.1
Gamaredon GroupG0047 ↗
Has checked existing conditions, such as geographic location, device type, or system specification, before the victim is sent a malicious Word document.1
All 7 groups for this technique · 6 newest in this preview
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Operation Dream JobC0022 ↗
During Operation Dream Job, Lazarus Group used tools that conducted a variety of system checks to detect sandboxes or VMware services.1
FrankensteinC0001 ↗
During Frankenstein, the threat actors used a script that ran WMI queries to check if a VM or sandbox was running, including VMWare and Virtualbox. The script would also call WMI to determine the number of cores allocated to the system; if less than two the script would stop execution.1
All 2 campaigns for this technique
61 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Mini Shai-HuludS9043 ↗
Has evaded execution in virtual environments and sandboxes through checking system information to include the number of CPUs and exiting at times when there were less than four and other times when there were less than two CPUs.123
HeartCryptS9018 ↗
Will attempt to load non-existent DLLs in attempt to detect sandbox creation of a dummy DLL to prevent the program from crashing.1
Lumma StealerS1213 ↗
Has queried system resources on the victim device to identify if it is executing in a sandbox or virtualized environments, checking usernames, conducting WMI queries for system details, checking for files commonly found in virtualized environments, searching system services, and inspecting process names.1 Lumma Stealer has checked system GPU configurations for sandbox detection.2
XLoaderS1207 ↗
Performs timing checks using the Read-Time Stamp Counter (RDTSC) instruction on the victim CPU.1
BlackByte RansomwareS1180 ↗
Checks for files related to known sandboxes.1
ExbyteS1179 ↗
Performs various checks to determine if it is running in a sandboxed environment to prevent analysis.1
All 61 software entries for this technique · 6 newest in this preview
Offense vs defense T1497.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 0
first rule: 2021 Q3 · 2 of 2 campaigns plottedSystem Checks detection strategy DET0168
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Virtualization/Sandbox Evasion via System Checks across Windows, Linux, macOS
3 platforms
AN0478 · Windows
Script or binary performs a rapid sequence of system discovery checks (e.g., CPU count, RAM size, registry keys, running processes) indicative of VM detection
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Sequence of system enumeration events within X seconds |
| ProcessAncestry | Parent-child lineage to identify potentially suspicious launch sources (e.g., Office, browser, WMI, PowerShell) |
| UserContext | Limit to non-admin or interactive sessions if desired |
AN0479 · Linux
Shell script or binary uses multiple system commands (e.g., dmidecode, lscpu, lspci) in quick succession to detect virtualization environment
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve of system tools like dmidecode, lspci, lscpu, dmesg, systemd-detect-virt |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Burst of system info commands within X seconds |
| CommandPattern | Regex or substring matching virtualization artifact checks |
AN0480 · macOS
Bash, Swift, or Objective-C programs enumerate system profile, I/O registry, or inspect kernel extensions to identify VM artifacts
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | exec or spawn of 'system_profiler', 'ioreg', 'kextstat', 'sysctl', or calls to sysctl API |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ExecutionBurst | Threshold of sequential system checks or tools used in a short time |
| ToolName | Specific tools used for querying device and system metadata |
Tests8Executorssh 6 · PowerShell 2Need elevation2 of 8Have prerequisites0Have cleanup1Platformslinux, windows, macos
Tests from Atomic Red Team (MIT licence) · technique definition